Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently transitioning our existing database based authentication to Active Directory. In the existing implementation, passwords are kept in clear-text in the database (I know this is bad, this is why we are transitioning). When a user logs into our client-side application (not a browser), the application hashes the password using an MD5 hash, and sends it to the server. The server queries the database for the login supplied, hashes the clear-text password, and compares the result.

Because this is a client side application, it takes time to upgrade all of our clients (could be months). So, we would like to support both authentication methods until clients are full transitioned over.

One way of doing this would be to have a single Active Directory user have two passwords, the real password, and an MD5 hash of the password. If they come in with either, they will be authenticated.

Can a single user support multiple passwords in Active Directory?

For example, can the real user Jon Smith have two sets of login passwords: 1. login = "jon", password = "pass1" 2. login = "jon", password = "pass2"

If Jon passes in either of these at login time, he will be successfully authenticated.

Thanks

share|improve this question
1  
???? Sounds like you're describing two separate user accounts to me ???? –  Darth Satan Jun 23 '09 at 16:12

6 Answers 6

up vote 3 down vote accepted

The answer to this is basically, no. AD allows only one password per user account. Because AD has the user name, and the pre-2000 username, I suppose you could cludge together 2 usernames for one account, but its not a good idea. Any particular reason you need this? Maybe there is a better solution to your needs?

share|improve this answer

You can not have more than one password, but you can have multiple usernames using multiple UPN extensions.

i.e. for the domain contoso.com you could have the logins: jim@contoso.com jim@fabrikam.com jim@whateverelse.com

All of these associated with the same account. However, you would still only have one password.

share|improve this answer

What you want to do is alter your clients to check authentication against two sources.

In other words, keep your existing database while you are transitioning to Active Directory. Have the clients check the AD account and if that doesn't auth, have them check the legacy auth source.

Any damage you do to make AD accept multiple usernames/passwords will be something you deal with for a long time. Just run parallel authentication sources until you're all transitioned.

share|improve this answer
    
+1 for using dual authentication sources but I would recommend altering the server, not the clients. Have the clients keep sending credentials to the server as they are doing but on the server-side of the application, check AD and then the legacy source. If the client app was abstracted from the authentication source, you wouldn't even need to alter the clients to change how you're checking their credentials. –  David Archer Jun 24 '09 at 23:36
    
David: Thanks! I do disagree with the transitioning method, though. I think that in the long term, it would be better to have the client authenticate directly to AD. That would eliminate the need to maintain two systems (the AD source and the abstraction layer), since authentication methods aren't changed so often. That's just my take, though. I may be wrong. –  Matt Simmons Jun 25 '09 at 0:50

I can't really see why you would have a need to do this, but I agree with Sam in that there is no real way to do this.

You can copy a user or give a user the exact same permissions, and even access to the same mailbox and resources etc, but I don't see a way to have multiple usernames for one account.

share|improve this answer

Active Directory doesn't support what you're describing for a single security-identifier (SID). Each SID can have exactly one username/password combination.

You can do this functionally, to a point, by creating a group object in which "jon1" and "jon2" are both members, and using that group in all permissions (filesystem, Exchange mailbox, etc) relating to "Jon Smith". (You should be using groups for almost every permission anyway.) So long as you aren't using any software that can't handle a group's SID being used instead of either of the SIDs from Jon's user accounts you'll be just fine.

share|improve this answer

There is a very ugly way you could do this, but WHY would you want to?

Active Directory user IDs are really just a shorthand way of identifying an account by its REAL name, the Security Identifier or SID. Each user object has several attributes assigned to it that can be used to logon with: samaccountname, User principal name, etc. These could potentially have different values, but you would still only have a SINGLE password. You could "copy" a user via the "Users and Computers" MMC console, which would ensure that both users accounts have the same group memberships, and generic data, but then you would STILL have two distinct user objects with different passwords. They would have different SIDs and would be considered different users by the AD, although you can make them LOOK the same by giving the accounts the exact same Display Name.

If you REALLY, REALLY want to break your AD, you can try to use the SID-History attribute to insert a duplicate SID into the Directory. I highly recommend you not try to do this. In fact, you will have a difficult time doing it unless you are EXTREMELY familiar with AD structure and low-level programming. The Microsoft migration tools will NOT let you insert a duplicate SID into SID history, as this is supposed to be a unique attribute value. I believe that it can be done if you write your own access methods in using MFC and override a number of the built-in safeguards. BUT DO NOT DO THIS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.